Skip to content

Commit 72bfb35

Browse files
bryantbiggsbryantbiggs
authored
docs: Add usage patterns for authenticated listeners from Atlantis module docs (#319)
1 parent 3289f9f commit 72bfb35

File tree

1 file changed

+124
-8
lines changed

1 file changed

+124
-8
lines changed

‎docs/patterns.md‎

Lines changed: 124 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ module "alb" {
1515
# Truncated for brevity ...
1616
1717
listeners = {
18-
ex-http-https-redirect = {
18+
http_https_redirect = {
1919
port = 80
2020
protocol = "HTTP"
2121
redirect = {
@@ -39,7 +39,7 @@ module "alb" {
3939
# Truncated for brevity ...
4040
4141
listeners = {
42-
ex-fixed-response = {
42+
fixed_response = {
4343
port = 80
4444
protocol = "HTTP"
4545
fixed_response = {
@@ -52,6 +52,122 @@ module "alb" {
5252
}
5353
```
5454

55+
### Auth0 authenticated HTTPS Listener
56+
57+
The configuration snippet below creates an HTTPS listener that utilizes [Auth0](https://www.auth0.com) to secure access. Read more in [this post](https://medium.com/@sandrinodm/securing-your-applications-with-aws-alb-built-in-authentication-and-auth0-310ad84c8595).
58+
59+
```hcl
60+
module "alb" {
61+
source = "terraform-aws-modules/alb/aws"
62+
63+
# Truncated for brevity ...
64+
65+
listeners = {
66+
https_auth0 = {
67+
port = 443
68+
protocol = "HTTPS"
69+
certificate_arn = "arn:aws:acm:eu-west-1:135367859851:certificate/70e008e1-c0e1-4c7e-9670-7bb5bd4f5a84"
70+
71+
authenticate_oidc = {
72+
issuer = "https://youruser.eu.auth0.com/"
73+
token_endpoint = "https://youruser.eu.auth0.com/oauth/token"
74+
user_info_endpoint = "https://youruser.eu.auth0.com/userinfo"
75+
authorization_endpoint = "https://youruser.eu.auth0.com/authorize"
76+
authentication_request_extra_params = {}
77+
client_id = "clientid"
78+
client_secret = "secret123" # a data source would be good here
79+
}
80+
}
81+
}
82+
}
83+
```
84+
85+
### Okta authenticated HTTPS Listener
86+
87+
The configuration snippet below creates an HTTPS listener that utilizes [Okta](https://www.okta.com/) to secure access. Read more in [this post](https://medium.com/swlh/aws-alb-authentication-with-okta-oidc-using-terraform-902cd8289db4).
88+
89+
```hcl
90+
module "alb" {
91+
source = "terraform-aws-modules/alb/aws"
92+
93+
# Truncated for brevity ...
94+
95+
listeners = {
96+
https_okta = {
97+
port = 443
98+
protocol = "HTTPS"
99+
certificate_arn = "arn:aws:acm:eu-west-1:135367859851:certificate/70e008e1-c0e1-4c7e-9670-7bb5bd4f5a84"
100+
101+
authenticate_oidc = {
102+
issuer = "https://dev-42069.okta.com/"
103+
token_endpoint = "https://dev-42069.okta.com/oauth2/v1/token"
104+
user_info_endpoint = "https://dev-42069.okta.com/oauth2/v1/userinfo"
105+
authorization_endpoint = "https://dev-42069.okta.com/oauth2/v1/authorize"
106+
authentication_request_extra_params = {}
107+
client_id = "clientid"
108+
client_secret = "secret123" # a data source would be good here
109+
}
110+
}
111+
}
112+
}
113+
```
114+
115+
### Google authenticated HTTPS Listener
116+
117+
The configuration snippet below creates an HTTPS listener that utilizes Google to secure access. See the [iap_client resource](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iap_client) in the Google provider if you want to create this configuration in Terraform. Remember to set your google consent screen to internal to only allow users from your own domain.
118+
119+
```hcl
120+
module "alb" {
121+
source = "terraform-aws-modules/alb/aws"
122+
123+
# Truncated for brevity ...
124+
125+
listeners = {
126+
https_google = {
127+
port = 443
128+
protocol = "HTTPS"
129+
certificate_arn = "arn:aws:acm:eu-west-1:135367859851:certificate/70e008e1-c0e1-4c7e-9670-7bb5bd4f5a84"
130+
131+
authenticate_oidc = {
132+
issuer = "https://accounts.google.com"
133+
token_endpoint = "https://oauth2.googleapis.com/token"
134+
user_info_endpoint = "https://openidconnect.googleapis.com/v1/userinfo"
135+
authorization_endpoint = "https://accounts.google.com/o/oauth2/v2/auth"
136+
authentication_request_extra_params = {}
137+
client_id = "google_client_id"
138+
client_secret = "google_client_secret"
139+
}
140+
}
141+
}
142+
}
143+
```
144+
145+
### Amazon Cognito authenticated HTTPS Listener
146+
147+
The configuration snippet below creates an HTTPS listener that utilizes [Amazon Cognito](https://aws.amazon.com/cognito/) to secure access. See the [iap_client resource](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iap_client) in the Google provider if you want to create this configuration in Terraform. Remember to set your google consent screen to internal to only allow users from your own domain.
148+
149+
```hcl
150+
module "alb" {
151+
source = "terraform-aws-modules/alb/aws"
152+
153+
# Truncated for brevity ...
154+
155+
listeners = {
156+
https_cognito = {
157+
port = 443
158+
protocol = "HTTPS"
159+
certificate_arn = "arn:aws:acm:eu-west-1:135367859851:certificate/70e008e1-c0e1-4c7e-9670-7bb5bd4f5a84"
160+
161+
authenticate_cognito = {
162+
user_pool_arn = "arn:aws:cognito-idp:eu-west-1:1234567890:userpool/eu-west-1_aBcDeFG"
163+
user_pool_client_id = "clientid123"
164+
user_pool_domain = "sso.your-corp.com"
165+
}
166+
}
167+
}
168+
}
169+
```
170+
55171
## Target Groups
56172

57173
### Instance Target Group
@@ -65,7 +181,7 @@ module "alb" {
65181
# Truncated for brevity ...
66182
67183
listeners = {
68-
ex-https = {
184+
ex_https = {
69185
port = 443
70186
protocol = "HTTPS"
71187
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-Res-2021-06"
@@ -81,7 +197,7 @@ module "alb" {
81197
82198
target_groups = {
83199
# This key name is used by the listener/listener rules to know which target to forward traffic to
84-
ex-instance = {
200+
ex_instance = {
85201
name_prefix = "h1"
86202
backend_protocol = "HTTP"
87203
backend_port = 80
@@ -104,7 +220,7 @@ module "alb" {
104220
# Truncated for brevity ...
105221
106222
listeners = {
107-
ex-http-weighted-target = {
223+
http_weighted_target = {
108224
port = 80
109225
protocol = "HTTP"
110226
weighted_forward = {
@@ -123,14 +239,14 @@ module "alb" {
123239
}
124240
125241
target_groups = {
126-
ex-lambda-with-trigger = {
242+
lambda_with_trigger = {
127243
name_prefix = "l1-"
128244
target_type = "lambda"
129245
lambda_multi_value_headers_enabled = true
130246
target_id = module.lambda_with_allowed_triggers.lambda_function_arn
131247
}
132248
133-
ex-lambda-without-trigger = {
249+
lambda_without_trigger = {
134250
name_prefix = "l2-"
135251
target_type = "lambda"
136252
target_id = module.lambda_without_allowed_triggers.lambda_function_arn
@@ -175,7 +291,7 @@ module "alb" {
175291
# Truncated for brevity ...
176292
177293
target_groups = {
178-
ex-ip = {
294+
ex_ip = {
179295
backend_protocol = "HTTP"
180296
backend_port = 80
181297
target_type = "ip"

0 commit comments

Comments
 (0)